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DETAILED ACTION 

1 . This Office Action is prompted by the Applicant's response filed 6-1 6-201 0. 
Claims 1,2, 4-6, 8-12, 14-20, 22, 24-28, 30-34, and 36-38 are pending and have been 
examined. 

Response to Arguments 

2. Applicant's arguments with respect to claims 1 , 2, 4-6, 8-1 2, 1 4-20, 22, 24-28, 
30-34, 36 and 37 have been considered but are moot in view of the new ground(s) of 
rejection. 

3. Claim 38 represents claim 7 rewritten in independent form. The previously 
indicated allowability of (now cancelled) claim 7 is withdrawn in view of a 
reconsideration of the Atkinson reference. A rejection of claim 38 based on the cited 
references follow. 

Claim Rejections - 35 USC § 101 

4. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

5. Claims 1, 2, 4-6, 8-10, 22, 24-28, 30-33 and 37 are rejected under 35 U.S.C. 101 
because the claimed invention is directed to non-statutory subject matter. 
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Claims 1,2, 4-6, 8-10, and 33 are rejected under 35 U.S.C. 101 based on 
Supreme Court precedent and recent Federal Circuit decisions, a 35 U.S.C § 101 
process must (1) be tied to a particular machine or (2) transform underlying subject 
matter (such as an article or materials) to a different state or thing, in re Bilski et al, 88 
USPQ 2d 1385 CAFC (2008); Diamond v. Diehr, 450 U.S. 175, 184 (1981); Parker v. 
Flook, 437 U.S. 584, 588 n.9 (1978); Gottschalk v. Benson, 409 U.S. 63, 70 (1972); 
Cochrane v. Deener, 94 U.S. 780,787-88 (1876). An example of a method claim that 
would not qualify as a statutory process would be a claim that recited purely mental 
steps. Thus, to qualify as a § 101 statutory process, the claim should positively recite 
the particular machine to which it is tied, for example by identifying the apparatus that 
accomplishes the method steps, or positively recite the subject matter that is being 
transformed, for example by identifying the material that is being changed to a different 
state. Here, the applicant's method steps are not tied to a particular machine and do not 
perform a transformation. Thus, the claims are non-statutory. The mere recitation of the 
machine in the preamble with an absence of a machine in the body of the claim fails to 
make the claim statutory under 35 USC 101 . Note the Board of Patent Appeals 
Informative Opinion Ex parte Langemyer et al. 

As for claims 22, 24-28, 30-32 and 37, the claims are directed towards a 
computer-readable medium storing computer-readable instructions, however, the claims 
do not positively recite any limitation that specifies the software as being embodied in a 
non-transitory computer readable medium. Therefore the claims set forth only functional 



Application/Control Number: 10/577,660 Page 4 

Art Unit: 2437 

descriptive language and are non-statutory since this does not fall into one of the 
classes of invention eligible for the grant of a US patent. Unless embodied in a non- 
transitory computer-readable medium the software in and of itself cannot be considered 
as a computer component, and hence cannot effect a change of state of a processor to 
produce a useful or tangible result. 

Claim Rejections - 35 USC § 103 

6. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

7. Claim 38 is rejected under 35 U.S.C. 103(a) as being unpatentable over Cowie et 
al. US 2003/0023865 A1 , Atkinson, US 5,892,904, and Pierre Richer: SANS/GIAC 
Practical Assignment for GSEC Certification Version 1 .4b: Steganalysis: Detecting 
hidden information with computer forensic analysis, SANS Institute 2003 (Submitted 
with the Applicant's IDS). 

As for claim 38, Cowie teaches a method, comprising, obtaining a signature by 
reading code comprising a partial section of a program, (fig. 5: element 18, [0015], 
[0034], [0048]) comparing the signature with one or more computer files (fig. 5: element 
18, [0015], [0034], [0048]), and, displaying a listing of which of the one or more 
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computer-files provide a match with the signature (fig. 6 element 46, [0050]). Cowie 
does not teach that the code read is executable code, or that files not accessible to a 
system administrator are excluded from comparison. However Atkinson does teach 
these features (col. 7 line 23 through col. 8 line 22: executable code is evaluated, col. 8 
lines 30-35: software from trusted sources is automatically downloaded to a user 
without evaluation and therefore comprises software not accessible to a system 
administrator since a user may download this software directly). Therefore it would 
have been obvious to one of ordinary skill in the art at the time the invention was made 
to incorporate these features of Atkinson into the system of Cowie. It would have been 
obvious to do so since this would increase the probability of detecting hidden malware 
code in a file, and speeding processing time by excluding already trusted files from 
evaluation. Cowie fails to teach the feature where the computer-program is a 
steganographic program configured to introduce steganographic items into a computer 
file. . However Richer does teach such a feature (page 4: Tools Used to Hide 
Information, page 6: Detecting Hidden Information With Various Resources: 1.) 
Guidance Software Inc. where comparisons of an original file MD5 hash is made with a 
MD5 hash of a suspect file in order to detect steganographically embedded data). 
Therefore it would have been obvious to one of ordinary skill in the art at the time the 
invention was made to incorporate this feature into the system of Cowie. It would have 
been obvious to do so since this would extend the types of programs that can be 
evaluated for embedded malware detectable via the comparison step of Cowie. 
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Allowable Subject Matter 

8. Claims 1, 2, 4-6, 8-12, 14-20, 22, 24-28, 30-34, 36 and 37 would be allowable if 
the rejections under 35 USC Sec. 101 were overcome. 



Conclusion 

9. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Paul E. Callahan whose telephone number is (571) 272- 
3869. The examiner can normally be reached on M-F from 9 to 5. 

If attempts to reach the examiner by telephone are unsuccessful, the Examiner's 
supervisor, Emmanuel Moise, can be reached on (571) 272-3865. The fax phone 
number for the organization where this application or proceeding is assigned is: (571) 
273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
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